I am monitoring ES_EVENT_TYPE_AUTH_OPEN
events, however I am interested in only a few processes (list is not hardcoded, it is configurable).
So I am using es_mute_process to mute most of the processes from ES_EVENT_TYPE_AUTH_OPEN event callback.
After some time, es_mute_process calls start failing.
On checking currently muted process count using es_muted_processes, it is always 255.
Is there an upper limit on number of processes that can be muted?
If there is a limit but if I keep on trying to mute processes even after the limit, as slots might become available if some of the processes exit, would that cause any impact on performance?
Am I supposed to detect the error and may be stop muting processes for some time?
Yes. We increased the limit substantially in 10.15.6 and this can be tested in the latest betas.Is there an upper limit on number of processes that can be muted?
I would expect the impact to be minimal. There is a non-zero cost to attempting to mute a process as this call has to enter the kernel, but it is unlikely to be more than most syscalls.If there is a limit but if I keep on trying to mute processes even after the limit, as slots might become available if some of the processes exit, would that cause any impact on performance?
And just to confirm as you noted - ES will automatically remove items from the set of muted processes as they exit, there is nothing for your client to do manually.
It isn't strictly necessary to stop attempting to mute - just know that it can fail for various reason, mainly reaching the limit.Am I supposed to detect the error and may be stop muting processes for some time?